redmine_expert_agile 0.2.0

redmine_expert_agile 0.2.0 – 2026-08-14

Security

• A saved board or backlog could be opened by anyone who knew its id. Both lookups resolved
  the id straight from the table, so a private board belonging to another user opened for any
  member of the project — its name and its whole filter set, though not issue data, which
  Issue.visible still gates. Both now resolve through visible and global_or_on_project, the
  scope the sidebar and the query controller already used.
• A saved board or backlog stayed open after it stopped being visible. The session carries
  only an id and outlives the query it points at, so an owner turning a shared board private, or a
  role losing the permission, had no effect until the viewer's session happened to end. The
  session restore now resolves through the same scope and falls back to a fresh board when the
  saved one is gone or no longer visible.

Added

• The backlog planner has the board's filter and options panel. The backlog tab was the one
  agile screen without one: it built a throwaway query on every request, so it always showed every
  open issue of the project and nothing a user chose survived a page reload. It now carries the
  same panel the board does — Redmine's own filter widget, a collapsible Options fieldset with
  card fields and colouring, and Apply / Clear / Save — persisted in its own session key so
  coming back via the project menu shows the backlog as it was left. There is no status-column or
  WIP part: the planner deliberately ignores where an issue sits in the workflow.
• Saved backlogs. A backlog can be saved, edited and deleted like a board or a chart, and
  saved backlogs are listed in the agile sidebar, which the backlog tab now renders. They are
  ExpertAgileBacklogQuery rows in Redmine's queries table, visible through the
  view_expert_agile_backlog permission rather than the board's, and
  ExpertAgileBacklogQueriesController is the board's query controller pointed at that class —
  the same reuse the charts variant already uses. Saving needs add_expert_agile_queries, which
  lives in the expert_agile module, so a project running the backlog module alone can filter but
  not save.
• Backlog cards show the fields the panel selects. They were a fixed set of id, tracker,
  subject, status and story points; they now render the assignee and avatar, estimated hours, done
  ratio, the description excerpt and any selected column including custom fields, exactly as a
  board card does.
• Screenshots in both READMEs. README.md and README.de.md now open a Screenshots section
  covering the board with its sub-columns and WIP limits, swimlanes, the backlog planner, the
  sprint list, story points on the issue form, burndown, velocity, cumulative flow, the card
  colours screen and the plugin settings — so the plugin can be evaluated without installing it
  first. The images live in docs/screenshots/{en,de}/ and, like the rest of docs/, are excluded
  from the release archives, so the installable package does not grow.
• scripts/seed_screenshot_demo.rb and scripts/teardown_screenshot_demo.rb build and remove
  the synthetic demo project the screenshots are taken from: five sprints across the
  open/active/closed lifecycle, ~130 issues with backdated status journals so the
  history-replaying charts have something to replay, story points, board positions, time entries,
  card colours and three saved boards. Unlike their helpdesk counterparts these scripts do write
  global state — story points and sprints are off by default and neither feature is visible
  otherwise — so the seed records every value and every row id it touches in an
  expert_agile_screenshot_backup setting and the teardown restores the instance from it.
  RELABEL=de renames the demo statuses between the English and the German capture pass, so both
  screenshot sets share one dataset. Both scripts refuse to run without DEMO_STACK=1: they boot
  under the official Redmine image, which runs in production mode, so Rails.env cannot tell a
  disposable database from a real one and the opt-in has to be typed.

Fixed

• A chart saved from its own screen was stored as a board. expert_agile_queries/new and
  edit hardcoded the board's routes, so every variant of the query controller posted its form to
  ExpertAgileQueriesController regardless of which screen it came from. Where the shared form
  posts, and what it is titled, is now the controller's business. The charts variant had no Save
  link in the UI, so this only ever bit the API; the backlog would have hit it on the first click.
• "Show future data on charts" did nothing. The setting was declared, documented in the
  settings screen and read by RedmineExpertAgile.chart_future_data?, but no chart ever consulted
  it: every series was drawn to the end of the selected range, so a burndown looked at mid-sprint
  ran flat from today to the sprint end and a velocity chart showed empty buckets for weeks that
  have not happened. Measured series (:actual, :total, :created, :closed, :trend) now
  stop at today unless the setting is on, while the ideal line — a projection, not a measurement —
  still spans the whole range. An interval bucket that merely contains today is kept, because a
  week is legitimately partial on the day you look at it.
• Cumulative flow bands were indistinguishable. The band colour was a hue derived from the
  status's index among all of the instance's statuses, so on an installation with fifty statuses
  a six-band chart drew six neighbouring hues — six shades of the same pink, one on top of the
  other. The palette is now spread over the bands the chart actually draws, so the bands are as far
  apart on the colour wheel as they can be.
• Untranslated column header on the card colours screen. The table header called
  l(:label_name), a key neither the plugin nor Redmine defines, so the admin screen rendered
  "Translation missing: en.label_name". It now uses Redmine's own field_name.
• The documented test command ran the wrong plugin. Both READMEs put PLUGIN= in front of
  docker-compose … run, where it stays a shell variable and never reaches the container — the
  service fell through to its default and the helpdesk suite ran instead, reporting a clean 417
  green tests while the agile suite was never executed. The command now passes -e PLUGIN=….